Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 09:50

General

  • Target

    FACTURĂ.docx

  • Size

    141KB

  • MD5

    584410ce253da7a7a165233ca100ca83

  • SHA1

    4be0e18e971f0c8443aba983826312f1a9103f0a

  • SHA256

    773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5

  • SHA512

    66555af131b8d9474bc3db81227b3ef4e74a7b3bc678b5715a54b52017d99f266729cbc2358425d09bcded014f6682633d30f2e1122a140faa54527c221348ae

  • SSDEEP

    3072:nHjiNnE9xcCSbQcFyjZ9p7p6+1Ghfu+uUsw8Okcf:HedEFSbQ4gZ939Ou+uUsw7ki

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\FACTURĂ.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8AC3C5E0.emf

    Filesize

    16KB

    MD5

    767d8595d67d70f6c19ed869df119765

    SHA1

    8ceb76d98dde5e69bf541623ec5ac6f034e6edb8

    SHA256

    8a05aef60aa3ca524164d3c1c0ac369a2b42d00293b33533cfce3d5576877ef8

    SHA512

    794ce1be4440925efad4aa7823af3eca8b891109118a5e09414fc5a14e310db8af316d3e552ba22dac9bd0bd692f00955616cfdaec21c872f0a9377f3c61fc21

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\THHXO5RX\opningnewthingstobegreatattitudewithentirethingstogoreturrnwithallnewmanufacturesarehere________greatwayofreturnhim[1].doc

    Filesize

    92KB

    MD5

    7da751285a673c1b6b0459614a411267

    SHA1

    a340c1b262b48dd4b1726fab58b304de0c258acd

    SHA256

    ae69a637db88457f0e6f1b67e2f3b55b88bd95af602f4b1afe7dffc617593f2b

    SHA512

    948e0702adbbd5424a8cda0b246d52f45b642745a39a04708527d0968b3481c181b380d86040200508ae77d4fcaeb9ea6745f8568b375425f5ff0d8ab82074d9

  • C:\Users\Admin\AppData\Local\Temp\TCDB86.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    307B

    MD5

    0ea86afe4525144bba5257919f478b4a

    SHA1

    bed37edbaaba9a52d7cf8d4fd6fd49432948895e

    SHA256

    db1745243662a35b69abd8a69b7642aced1317f0e3274cea1a5e4bb4bd8e6a73

    SHA512

    12e9d3d4cbc4fdedc03327d5bd17fb37a41c9b26c298e3cd7e3c120365dce9a93e0df9eaf7182f26e2322f223094cf141940c6432b643ecc7c0e350c276ba3dd

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    680B

    MD5

    245b6647492f52540ddd98f62486bf75

    SHA1

    bd9ae0942bf6684f03a1dc0d693d219513985061

    SHA256

    a8ad72e26045d99a0753f112ba798d15260d2d16c86f16782a3eec4d39b97071

    SHA512

    416b03b4ef3f02cfda5d33c0bd01f86e576cf5c1415304697640a67cae06e418e0f16edfbbc3f73930f5203700f5fbda63e287848c49b6e93ce5393954bfd4d0

  • memory/3028-11-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-13-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-0-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

    Filesize

    64KB

  • memory/3028-8-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-12-0x00007FFDAE4F0000-0x00007FFDAE500000-memory.dmp

    Filesize

    64KB

  • memory/3028-7-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-14-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-15-0x00007FFDAE4F0000-0x00007FFDAE500000-memory.dmp

    Filesize

    64KB

  • memory/3028-18-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-19-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-22-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-21-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-20-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-17-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-16-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-10-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-6-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-9-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-5-0x00007FFDF09ED000-0x00007FFDF09EE000-memory.dmp

    Filesize

    4KB

  • memory/3028-3-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

    Filesize

    64KB

  • memory/3028-4-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

    Filesize

    64KB

  • memory/3028-2-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

    Filesize

    64KB

  • memory/3028-98-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3028-1-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

    Filesize

    64KB

  • memory/3028-605-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

    Filesize

    64KB

  • memory/3028-604-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

    Filesize

    64KB

  • memory/3028-606-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

    Filesize

    64KB

  • memory/3028-607-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

    Filesize

    64KB

  • memory/3028-608-0x00007FFDF0950000-0x00007FFDF0B45000-memory.dmp

    Filesize

    2.0MB